Modify proc_creation_win_ping_hex_ip.yml to look for hexidemical strings using regex

[vasquja]

Summary of the Pull Request

I found false positives in my org's environment when pinging by hostname where the string '0x' is included in the hostname. For example, this rule would identify the command 'ping c0xk2jhf79' when this is a host name, not a hex IP address. Using regex can look for string starting with 0x and containing 8 characters after, representing an IPv4 address and thereby reducing false-positive detections.

Changelog

Example Log Event

AccountName: SYSTEM
AccountType: User
Category: Process Create (rule: ProcessCreate)
Channel: Microsoft-Windows-Sysmon/Operational
CommandLine: ping c0xk2jhf79
Company: Microsoft Corporation
CurrentDirectory: F:
Description: TCP/IP Ping Command
Domain: NT AUTHORITY
EventCreated: 2025-04-02 15:00:35 Eastern Daylight Time
EventID: 1
EventReceivedTime: 2025-04-02T15:00:37.461571-04:00

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @vasquja 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃